I need to protect URL alias from being submitted. enter image description here

I've tried setting #disabled, #access, unset(), and what not. It hides the form, but the user is still able to modify the form on the client-side and submit it.

How do I prevent this form from being submitted on the client-side?

My current module code

function mymodule_form_alter(&$form, &$form_state){
  if (empty($form['type']['#value'])) return;
  $form['#after_build'][] = 'mymodule_after_built';

function mymodule_after_built($form, &$form_state) {
  $form['path']['#access'] = FALSE;
  $form['path']['alias']['#access'] = FALSE;
  $form['path']['alias']['#value'] = $form['path']['alias']['#default_value'];

  return ($form);


To clear the question, I am not asking how to hide the form, but how to prevent the end-user from manually altering the code and submitting the form I just hid.

End-user can just edit source code and add <input type="text" id="edit-path-alias" name="path[alias]" value="" size="60" maxlength="255" class="form-text"> and still enter the alias.

  • Why don't you just unset this field in hook_form_alter directly? I mean, a whole vertical tab. Try. And if you try and fail, post the code you tried. Make sure you inspect form's structure first, with kpr, var_dump or something.
    – Mołot
    Nov 13, 2014 at 22:13
  • I've tried unset($form['path']) in hook_form_alter. As far as I know, it's not possible to unset the form in hook_form_alter, unless attaching it to #after_built. Nov 13, 2014 at 22:29
  • I never experienced any serious problems with unsetting form elements directly. So 1) how do you know it's really $form['path']? 2) What exactly happened when you tried?
    – Mołot
    Nov 13, 2014 at 22:32
  • Also, see drupal.org/node/1131786 - was this what you are using? If solution stopped working, consider reopening that issue...
    – Mołot
    Nov 13, 2014 at 22:34
  • Good article. Yeah, because path is added in path_form_alter, it's not accessible in hook_form_alter, which is why #after_built seems like it's the only way to override it. Nov 13, 2014 at 22:37

2 Answers 2


Found the issue! It seems to be a Drupal bug.

#access set in #after_build does not completely override the #access settings, set in hook_form_alter.

In theory, a form is altered by hook_form_alter and hook_form_alter is altered by #after-build. When I try setting #access in hook_form_alter, to alter the form, everything works. However, when I try setting #access permissions in #after_build, to alter hook_form_alter, it only hides the form, still allowing anyone to submit it, by altering the code on the client side.

As a temporary solution, I disabled URL alias permissions, by unchecking "Administer URL aliases" and "Create and edit URL aliases".


If you set #access to FALSE in #after_build callback, the value will not be submitted even if it's sent to server.

  • That's what I thought also. But it is actually submitted to the server. My code example already sets the element #access to FALSE, but I'm still able to manually send the form to the server. Nov 14, 2014 at 5:47
  • Send is okay. But form API should not pass it in $form_state['values'] in submit callback. Does it? Nov 14, 2014 at 6:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.